We have the following search: index="app_foo_internal" source="*Log-Srv-1*" | rex ",(?<TransactionTime>\d+)$" | Where TransactionTime > 90000 This index contains only 2 hosts that make up the "Log-Srv-1". We are now getting alerts per event, but the problem is that sometimes we'll get a bunch of events within a single email alert, and other times just the one event (as expected). When we get a clump of events within one email alert, most of them are less than the Transaction timeout of 90000. In the event where we get a clump of events within one email, the event we want is always at the bottom of the list of events. This issue is sporadic. Do we have some sort of contention with both hosts having similar time stamps? There are a lot of logs on both hosts, so perhaps its too much volume? It should be just the one event per email. Not between 1 & 100. Any ideas? ... View more

Hello, Would anyone know the regex value for the final numeric value after the last comma in the following log entry: BlahBlah 2015/12/17 13:23:48:266,63 So all I need is the number after the last comma. It can be 1 or more digits (including zero). I'm creating a named variable, but this doesn't work: | rex ", (?P<TrasactionTime>\d+)$" | top 10 TrasactionTime Thanks! ... View more

Hello, I have 4 log files on one Host that I want to index/ingest. Log #1, #2, #3 will be ingested 24 hours a day, but log file #4 shares a batch process in the evening that has 20 - 30GB per evening of events that is not needed, nor do we want to pay for - because I wouldn't use them at this point in time. I want to avoid stopping the Splunk Universal Forwarder Windows service from 6pm to 6am because that would mean that logs #1, #2, & #3 will not index. Also, I believe it would pool up in the fish bucket anyway, so that will null my effort to exclude indexing from 6pm to 6am for log #4. Any ideas how I can avoid indexing log #4 from 6pm to 6am (night time batch window)? Thanks! ... View more

Hello, I want the exact graph that Splunk provides when you perform a search in one of my dashboards. How do I do that? When I save the search as a panel, I'm put into a position where I need to customize the graphing my self, which I fail miserably. The Splunk default one is nice because it auto adjusts based on time frames you search (i.e.: Search a full day, it will break down timeline by 1 hour sections, 365 day search, it will break it down into days or weeks, etc.). Thanks! ... View more